Have found a security issue in Symfony? Send the details to
security [at] symfony.com and don't
disclose it publicly until we can provide a fix for it.
Manage your notification preferences to receive an email as soon as a Symfony security release is published.
Generated URLs Can Point to a Host Chosen by the Client
November 4, 2026
#Security Advisories
Path Rules Enforced in Front of PHP Can Be Bypassed by Appending the Path to the Script Name
November 4, 2026
#Security Advisories
Incomplete Fix for CVE-2026-45756: JsonPath Queries Can Still Hold a Process Through search(), match() and Chained Filters
November 4, 2026
#Security Advisories
Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Hold a Process
November 4, 2026
#Security Advisories
Filesystem Path Treats Any Prefix Before "://" as a Root, Letting Paths Escape Their Base Directory
November 4, 2026
#Security Advisories
DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Letting a Client Read Any Server File
November 4, 2026
#Security Advisories
NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports: Incomplete Fix for CVE-2024-50342
November 4, 2026
#Security Advisories
Programmatic Logins Skip the checkPostAuth() Method of User Checkers
November 4, 2026
#Security Advisories
Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of the URLs Generated for the Main Request
November 4, 2026
#Security Advisories
ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
November 4, 2026
#Security Advisories